Files
felhom.eu/documentation/audits/facebook-first-post-2026-10-09/probe/A1-debug-token.json
T
admin e3741ae493
gates / gates (push) Successful in 6m5s
facebook: the first post SCHEDULED for 2026-10-12 19:00 (R-917 -> VERIFY)
Not public. It sits in Planner until Monday evening and can still be changed
or deleted there.

THE POST. Operator chose version 6.2 (kozepes), Hungarian only, 638 Unicode
characters, 0 emoji, 0 hashtags. He chose Monday over today on the reasoning
offered: it was Friday 15:08, the weakest evening of the week for a first
post, and three days in Planner is review time.

  post id   1360018983863273_122096547315511222
  due       2026-10-12 19:00 Europe/Budapest = epoch 1791824400 = 17:00 UTC
  link      https://felhom.eu/

READ BACK, and the hex check recomputed OUTSIDE the probe so it is not the
same instrument twice: is_published False; scheduled time sent == read;
message sha256 887514383eff997c on both sides (COPY.md 6.2 and what Facebook
returned). Present in GET /{page}/scheduled_posts. And from a DIFFERENT
CHANNEL than the API: Planner shows it on H 12 at 19:00 with the link card.

SCENARIO A, the dry check that had to come first. A throwaway scheduled post
WITH THE LINK was accepted -- so `link` is not refused on a scheduled post,
which was the open question. Read back hex-equal and unpublished, seen
PRESENT in the scheduled list, deleted, seen ABSENT in the same list. The
removal proof comes from the LIST, not from an error after DELETE, which is
what R-914 asked for.

CHECKED RATHER THAN COPIED. The post repeats the website's "56 alkalmazas".
The apps page carries 57 <div class="app-card"> while saying 56 -- which
reads as an off-by-one until you read the category line, "6 alkalmazas + 1
beepitett". The 57th card is FileBrowser, built into every box and
deliberately not counted; index.html says "56 telepitheto alkalmazas" too.
NOT-A-FINDING, and a "fix" would have made a live public page wrong.

R-917 -> VERIFY (close when the operator confirms it published and is
pinned). R-914 noted, NOT closed: schedule-post covers text + link only; the
photo path stays unbuilt because the spike could not prove a scheduled PHOTO
stays hidden, and the pin, comment moderation and post-insight read-back are
still missing.

Secret scan on the committed evidence: planted EAA decoy 1 -> 0 after
deletion, 0 access_token, no run.log.
2026-10-09 15:14:55 +02:00

64 lines
1.5 KiB
JSON

{
"api_version": "v26.0",
"at_utc": "2026-10-09T13:10:21Z",
"error": null,
"files": {},
"form": {},
"headers": {
"facebook-api-version": "v26.0",
"x-business-use-case-usage": "{\"4713349378884589\":[{\"type\":\"business_integration_system_user_platform_endpoints\",\"call_count\":1,\"total_cputime\":1,\"total_time\":1,\"estimated_time_to_regain_access\":0}]}",
"x-fb-rev": "1049833609",
"x-fb-trace-id": "AeidMitXgcP"
},
"http_status": 200,
"method": "GET",
"ok": true,
"path": "debug_token",
"query_keys": [
"input_token"
],
"response": {
"data": {
"app_id": "2273465403490709",
"application": "felhom.eu",
"data_access_expires_at": 0,
"expires_at": 0,
"granular_scopes": [
{
"scope": "pages_show_list"
},
{
"scope": "business_management"
},
{
"scope": "pages_read_engagement"
},
{
"scope": "pages_read_user_content"
},
{
"scope": "pages_manage_posts"
},
{
"scope": "pages_manage_engagement"
}
],
"is_valid": true,
"issued_at": 1791474515,
"scopes": [
"read_insights",
"pages_show_list",
"business_management",
"pages_read_engagement",
"pages_read_user_content",
"pages_manage_posts",
"pages_manage_engagement",
"public_profile"
],
"type": "SYSTEM_USER",
"user_id": "122094150717513084"
}
},
"step": "A1-debug-token"
}